allow_url_fopen controls whether PHP file functions can use supported URL wrappers, such as reading an HTTPS resource with a file-handling function. It is separate from cURL and from allow_url_include. A change should follow the application's documented needs.
IN THIS ARTICLE
Check access and requirements
Identify the exact failing operation and its error. An external connection can also fail because of a blocked destination, DNS problem, certificate verification issue or timeout. Record the current value so you can reverse an unnecessary configuration change.
01 Change the setting
- In DirectAdmin, open the appropriate user account and domain, then search for Select PHP Version. In Evolution it may appear under Extra Features. Open the CloudLinux selector, not an unrelated server administration page.
- Check the active PHP version and which websites the selector change will affect. DirectAdmin can expose both its native PHP selection and CloudLinux PHP Selector. The selected domain in DirectAdmin does not by itself prove that an Alt-PHP change is isolated to that domain. Check the selector scope before applying an account-wide change.
- Open Options and locate allow_url_fopen.
- Set the value required by the application and save if requested. Leave
allow_url_includedisabled unless a qualified administrator has a specific justified requirement; it is not needed merely to fetch an HTTPS document. - Retry the original operation against a trusted, expected endpoint. Verify the application still validates user-supplied URLs and does not fetch arbitrary internal addresses.
Confirm the expected result
Confirm the effective value in the application's diagnostics and test the original download or remote read. If the software uses cURL, changing this option may have no effect because cURL follows its own configuration and certificate validation.
Why can a remote request still fail with allow_url_fopen enabled?
A certificate error needs a valid remote certificate or trust configuration, not disabled TLS verification. If the control is unavailable or reverts, it may be restricted by server policy. Give support the application feature, destination hostname and error without exposing private URLs or access tokens.